GHSA-8648-h559-8h42

Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-28604

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	sitegeist/fluid-components	< 3.5.0	3.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-28604 advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/sitegeist/fluid-components/CVE-2023-28604.yaml web
https://github.com/sitegeist/fluid-components package
https://github.com/sitegeist/fluid-components/blob/master/Documentation/XssIssue.md web
https://typo3.org/security/advisory/typo3-ext-sa-2023-003 web